---
typeId: req
recordId: benac-cap-003
fields:
  title: Capability mediation
  statement: >-
    A Host Implementation shall mediate every granted capability.

    A Host Implementation shall not expose host resources directly to package operations
    outside granted capabilities.

    A Host Implementation shall not treat package trust, package approval, package
    interface selection, Station Profile information, package author identity, package
    name, signature verification, or import success as a substitute for a capability
    grant.

    Capability use shall be recorded according to the operation phase and evidence or
    effect requirements of the package operation.

    Denied, missing, expired, revoked, conflicted, unavailable, or not-yet-determined
    capabilities shall fail closed for the operation that requires them.
  rationale: >-
    The Station remains the authority boundary. Package operations receive mediated
    results, not ambient host power.
  verification: >-
    Tests attempt capability use without grants, with expired grants, with revoked
    grants, with conflicting grants, and with valid grants. Only valid scoped grants
    allow the mediated operation.
  testable: true
  status: draft
  area: BENAC-CAP
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Trust, policy, and capability model
  order: 92
---
